Forum Discussion

JRahm's avatar
JRahm
Icon for Admin rankAdmin
Aug 29, 2005

Allowing only active connections when member is disabled

Is there a way within an iRule to mandate that disabled members receive active connections only, and persistent and new connections are killed? This way the thin client in the field will requery from the GSS for a new address.

My attempt around the problem (below) does what I want it to at a pool level, but Session Directory works around me to still get new connections that *exist* in the Session Directory table back to the server that has been disabled for maintenance. I would like to *force down* a node without having to manually configure each one.


when CLIENT_ACCEPTED {
   if { [active_members pool1] == 0 } {
      log "Active members equals 0, using alternate pool"
      use pool2
      if { ([IP::client_addr] eq "10.100.100.100") || ([IP::client_addr] eq "10.100.100.101") } {
         log "Not persisting [IP::client_addr]"
         persist none
      } else { persist source_addr }
   }
}

This eliminates our GSS devices from persisting, and selects another pool if the active members are zero.

For learning sake, in the above rule I manually entered the alternate pool, but I'd like to round-robin the remaining pools on the BigIP when one is down for maintenance on the *use pool * line. Would this work:


class other_pools {
   "0 pool2"
   "1 pool3"
   "2 pool4"
   "3 pool5"
}
set getpool 0
for($getpool = 0; $getpool <= 3; $getpool++) {
   use pool [findclass $getpool $::other_pools " "]
   if {$getpool = 3 } {
      set getpool = 0
   }
}

2 Replies

  • I guess I was making it too complicating, this achieves my goals:

    
    when CLIENT_ACCEPTED {
       if { ([IP::client_addr] eq "10.10.192.8") || ([IP::client_addr] eq "10.20.192.8") } {
          persist none
          }
       if { [active_members stl-ac24-pool] == 0 } {
          reject          
          }
    }

    What is still unknown is whether or not I can "force down* the nodes with iRules so that the VIP doesn't respond to syn requests. Any ideas???
  • Colin_Walker_12's avatar
    Colin_Walker_12
    Historic F5 Account
    Well, as far as setting node states, that's something that's better handled by iControl. Click here

    If you're just looking to use the same rule and have the VIP not respond if all nodes are down...try using discard instead of reject.

    
    when CLIENT_ACCEPTED {
      if { ([IP::client_addr] eq "10.10.192.8") || ([IP::client_addr] eq "10.20.192.8") } {
        persist none
      }
      if { [active_members stl-ac24-pool] == 0 } {
        discard
      }
    }

    This should appear as a dead connection, since it will just drop the incoming request if there are no active members.

    Hope this helps,

    -Colin